{{ message }}
Repository navigation
[Bug] initContainers hardcode mcr.microsoft.com instead of using UNBOUNDED_IMAGE_REGISTRY #911
Description
Problem:
In air-gapped environments (AKS-Flex on-premise nodes), unbounded-operator-config is set with UNBOUNDED_IMAGE_REGISTRY=acr.azurecr.io.
$ ./kubectl-unbounded version
0.2.0 (commit: a1f0ca39, built: 2026-07-24T20:37:25Z)
$ ./kubectl-unbounded install --image-registry acr.azurecr.io --operator-image acr.azurecr.io/azure/unbounded-operator:v0.2.0
$ kubectl get configmap unbounded-operator-config -n unbounded-system -o yaml
apiVersion: v1
data:
UNBOUNDED_API_SERVER_ENDPOINT: ""
UNBOUNDED_IMAGE_REGISTRY: acr.azurecr.io
UNBOUNDED_REAP_LEGACY_RESOURCES: "true"
kind: ConfigMap
metadata:
creationTimestamp: "2026-10-14T16:21:11Z"
labels:
app.kubernetes.io/component: controller
app.kubernetes.io/name: unbounded-operator
name: unbounded-operator-config
namespace: unbounded-system
resourceVersion: "53078203"
While primary containers (gantry, unbounded-net-node, unbounded-net-controller) correctly pull from the custom ACR, initContainers remain hardcoded to mcr.microsoft.com/cbl-mariner/busybox:2.0.
$ for i in $(kubectl get pods -n unbounded-system | awk '{print $1}' | grep -v NAME) ; do echo $i ; kubectl describe pod -n unbounded-system $i | grep "Image: " ; done
gantry-6qf5k
Image: mcr.microsoft.com/cbl-mariner/busybox:2.0
Image: acr.azurecr.io/azure/gantry:v0.2.0
gantry-6t2hf
Image: mcr.microsoft.com/cbl-mariner/busybox:2.0
Image: acr.azurecr.io/azure/gantry:v0.2.0
gantry-containerd-config-2jw9z
Image: mcr.microsoft.com/cbl-mariner/busybox:2.0
gantry-containerd-config-2tp4m
Image: mcr.microsoft.com/cbl-mariner/busybox:2.0
gantry-containerd-config-85clb
Image: mcr.microsoft.com/cbl-mariner/busybox:2.0
gantry-containerd-config-kclst
Image: mcr.microsoft.com/cbl-mariner/busybox:2.0
gantry-jvfhz
Image: mcr.microsoft.com/cbl-mariner/busybox:2.0
Image: acr.azurecr.io/azure/gantry:v0.2.0
gantry-vhwdp
Image: mcr.microsoft.com/cbl-mariner/busybox:2.0
Image: acr.azurecr.io/azure/gantry:v0.2.0
unbounded-net-controller-5d7b8f8699-pn64k
Image: acr.azurecr.io/azure/unbounded-net-controller:v0.2.0
unbounded-net-node-28ghr
Image: acr.azurecr.io/azure/unbounded-net-node:v0.2.0
Image: acr.azurecr.io/azure/unbounded-net-node:v0.2.0
unbounded-net-node-jh6fg
Image: acr.azurecr.io/azure/unbounded-net-node:v0.2.0
Image: acr.azurecr.io/azure/unbounded-net-node:v0.2.0
unbounded-net-node-mqrnx
Image: acr.azurecr.io/azure/unbounded-net-node:v0.2.0
Image: acrazurecr.io/azure/unbounded-net-node:v0.2.0
unbounded-net-node-qx2gs
Image: acr.azurecr.io/azure/unbounded-net-node:v0.2.0
Image: acr.azurecr.io/azure/unbounded-net-node:v0.2.0
unbounded-operator-7fbdb9d4d7-8kwgp
Image: acr.azurecr.io/azure/unbounded-operator:v0.2.0
Impact:
On-premise air-gapped nodes cannot reach mcr.microsoft.com over the internet, causing pods to fail during initialization with ErrImagePull / ImagePullBackOff.
Expected Behavior:
initContainers must dynamically respect UNBOUNDED_IMAGE_REGISTRY or accept an override variable (e.g., UNBOUNDED_INIT_IMAGE).
Activity